IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.
References
| Link | Resource |
|---|---|
| https://www.ibm.com/support/pages/node/7273615 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
05 Jun 2026, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.ibm.com/support/pages/node/7273615 - Vendor Advisory | |
| First Time |
Ibm aspera High-speed Transfer Server
Ibm Ibm aspera High-speed Transfer Endpoint |
|
| CPE | cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:* cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:-:*:*:*:*:*:* cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:* cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:fixpack1:*:*:*:*:*:* cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:-:*:*:*:*:*:* cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:fixpack1:*:*:*:*:*:* |
27 May 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-27 14:17
Updated : 2026-06-05 18:57
NVD link : CVE-2026-9035
Mitre link : CVE-2026-9035
CVE.ORG link : CVE-2026-9035
JSON object : View
Products Affected
ibm
- aspera_high-speed_transfer_endpoint
- aspera_high-speed_transfer_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')